Privacy Policy

Sharkling is operated by Heap Labs LLC (“Heap Labs”, “we”, “us”), the data controller for sharkling.io and the Sharkling iOS and Android apps, a poker training service. This policy explains what personal data we collect, why, and the choices you have. It applies to the website, web app, and native apps; it does not cover third-party sites we link to.

Questions or requests: email support@heaplabs.co.

• Account data. Your email address, display name, and (if you sign in with Google) your Google account id and avatar. We never see your Google password. The native apps can be used without registration; in that case we create a random guest identifier and no guest email is collected from you.
• Learning activity. Lessons completed, drill and puzzle answers, XP, streaks, hearts, and accuracy stats — the data that powers your progress, leak dashboard, and personalized practice.
• Club and community content. Club membership, invitations, events, chat messages, shared hand discussions, reports, blocks, moderation decisions, and policy acknowledgements. We use these to operate clubs, prevent abuse, and enforce our rules.
• Billing data. If you subscribe on the web, payments are processed by Stripe. Native subscriptions are processed by Apple or Google and coordinated through RevenueCat. We store your tier, status, store product and transaction references — never your card number.
• Technical data. Server logs (IP address, request path, timing) kept for security and debugging, and — where permitted or consented — analytics events (screens visited, features used) via Google Analytics 4 and Google Analytics for Firebase.

• We don't sell or rent your personal data, and we never have.
• We don't handle real-money gambling, wagers, or payouts of any kind — Sharkling is a training tool.
• We don't show third-party ads inside Sharkling. We do advertise Sharkling itself (for example on Google), and measure those ads under the consent rules below.

We use Google Analytics 4 and Google Analytics for Firebase with Google Consent Mode to understand which lessons land and where players get stuck. In the EEA, the UK, and Switzerland — where the law requires opt-in consent — no analytics cookies or identifiers are set unless you accept the consent banner; until then (and if you decline) Google receives only aggregate, cookieless, identifier-free signals on the website and no analytics storage in the native apps. Elsewhere, analytics runs by default; declining via the consent prompt or contacting us disables analytics storage, and we’ll remember the choice on this device. Native builds do not collect advertising identifiers. Declining never changes how the app works.

We also advertise Sharkling on Google. The same Google tag reports a conversion to Google Ads when someone who clicked one of our ads creates an account, and — with consent — Google may set advertising cookies to attribute those sign-ups and to build audiences for our own campaigns. Advertising signals follow exactly the same consent rules as analytics above: where opt-in is required, nothing identifier-based is shared unless you accept the banner, and declining anywhere switches Google to cookieless, aggregate, modeled measurement.

Your consent choice is stored in your browser’s local storage (key sharkling-consent). To change it, clear that value from your browser storage and revisit the site, or email us and we’ll walk you through it.

• Session cookie (essential) — keeps you signed in. Set by our auth system; no consent required because the app can’t work without it.
• Consent choice (essential, local storage) — remembers your analytics decision.
• Analytics cookies (optional, _ga*) — set only when analytics is active, per the consent rules above.
• Advertising cookies (optional, _gcl*) — set by the Google Ads tag only when ads measurement is active, per the same consent rules.
• Sign-up marker (essential, sl-signup-pending) — a short-lived cookie set right after account creation so your browser reports the sign-up once; it expires within an hour.

We use a small set of infrastructure providers, each under a data processing agreement, and share only what each needs:

• Amazon Web Services (USA, us-east-1) — hosting, database, and log storage.
• Stripe (USA) — web payment processing and subscription billing.
• Apple and Google — native app distribution and in-app subscription billing.
• RevenueCat (USA) — native subscription status and entitlement coordination.
• Resend (USA) — transactional email (sign-in links, receipts, streak reminders).
• Google (USA) — optional Google sign-in, Google Analytics 4, Google Analytics for Firebase, and Google Ads conversion measurement as described above.

Our servers are in the United States. If you use Sharkling from the EEA/UK, your data is transferred to the US under standard contractual clauses and, where applicable, the EU–US Data Privacy Framework certifications of the providers above.

Account, learning, and club-content data is kept while your account is active and deleted within 30 days of an account deletion request. Billing records and moderation/audit history may be retained as long as tax, accounting, safety, or legal obligations require. Server logs rotate automatically and are kept for no more than 90 days.

Depending on where you live (GDPR in the EEA/UK, CCPA/CPRA in California, and similar laws elsewhere), you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing based on legitimate interests. Email support@heaplabs.co and we’ll respond within 30 days. EEA/UK residents can also lodge a complaint with their local supervisory authority.

Sharkling teaches poker and is intended for adults. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we’ll delete it.

If we make material changes to this policy we’ll notify you by email or an in-app notice before they take effect. The “last updated” date above always reflects the current version. See also our Terms of Service.